CVE-2026-64266: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64266 Overview

CVE-2026-64266 is a use-after-free vulnerability in the Linux kernel's Filesystem in Userspace (FUSE) subsystem. The flaw resides in the fuse_ref_folio() function, which unlocks a request but fails to re-lock it before returning. When fuse_chan_abort() ends the request, the async end callback (for example fuse_writepage_free()) can free the request arguments while the subsequent copy chain logic still accesses them.

Critical Impact
A local attacker with low privileges can trigger a use-after-free condition in the Linux kernel FUSE driver, potentially leading to memory corruption, kernel crashes, or local privilege escalation.

Affected Products

Linux kernel (mainline and stable branches containing the vulnerable fuse_ref_folio() implementation)
Distributions shipping the affected FUSE subsystem code
Systems mounting FUSE filesystems accessible to unprivileged users

Discovery Timeline

2026-07-25 - CVE-2026-64266 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64266

Vulnerability Analysis

The vulnerability is a use-after-free ([CWE-416]) in the Linux kernel's FUSE subsystem. The fuse_ref_folio() function releases the request lock during folio reference handling but does not reacquire it before returning to the caller. This lock imbalance creates a narrow window during which concurrent request termination can free the underlying arguments structure.

When fuse_chan_abort() executes during this window, it invokes the async end callback for the in-flight request. Callbacks such as fuse_writepage_free() release the args memory tied to the request. Subsequent copy chain logic in the caller then dereferences the freed arguments, producing a classic use-after-free access pattern.

Exploitation requires local access and the ability to interact with a FUSE mount. Successful exploitation can corrupt kernel memory, crash the system, or be chained with heap grooming techniques for privilege escalation.

Root Cause

The root cause is asymmetric locking in fuse_ref_folio(). The function unlocks the request internally but omits the corresponding re-lock before returning. Callers assume the request remains locked, allowing concurrent abort paths to race with copy chain operations and free memory still in use by the caller.

Attack Vector

An attacker with local, low-privilege access mounts or interacts with a FUSE filesystem. By racing FUSE request handling against channel abort, the attacker triggers fuse_ref_folio() to return with the request unlocked. The concurrent abort path then frees the request arguments, and the subsequent copy chain accesses the freed memory. Technical details are available in the upstream kernel commits referenced in the kernel.org stable tree.

No verified public proof-of-concept code is available for this issue. The vulnerability mechanism is documented in the upstream fix commits.

Detection Methods for CVE-2026-64266

Indicators of Compromise

Unexpected kernel panics or oops messages referencing fuse_ref_folio, fuse_writepage_free, or fuse_chan_abort in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free access within the FUSE call stack
Unprivileged processes repeatedly mounting FUSE filesystems and issuing abort operations in short intervals

Detection Strategies

Monitor kernel logs for FUSE-related crash signatures and stack traces implicating fuse_ref_folio()
Audit installed kernel versions against the fixed commits in the stable tree and flag hosts running unpatched builds
Enable KASAN on test and pre-production kernels to surface use-after-free conditions during fuzzing of the FUSE interface

Monitoring Recommendations

Track mount and umount syscall activity involving FUSE filesystems by unprivileged users
Alert on repeated kernel oops events on the same host, especially those referencing FUSE symbols
Correlate process telemetry for tools that abuse FUSE (custom libfuse binaries) with kernel instability events

How to Mitigate CVE-2026-64266

Immediate Actions Required

Apply the upstream Linux kernel patches from the stable tree commit series that re-lock the request in fuse_ref_folio() before returning
Update to the fixed kernel version supplied by your Linux distribution vendor as soon as it becomes available
Restrict unprivileged FUSE mounts on multi-tenant and shared systems until patched kernels are deployed

Patch Information

The fix locks the request in fuse_ref_folio() before returning, restoring the caller's locking assumption and preventing the abort path from freeing arguments still in use. Fixes are available in multiple stable branches. See the referenced commits: 0e4a5a00, 1ca605cf, 1f915671, 5630da21, 65a1c255, b5befa80, be353caf, and e6aa5397.

Workarounds

Disable unprivileged FUSE mounts by setting user_allow_other off in /etc/fuse.conf and restricting the fusermount binary to trusted users
Remove or restrict the FUSE kernel module on systems that do not require userspace filesystems (modprobe -r fuse)
Apply mandatory access control policies (SELinux, AppArmor) to constrain processes that interact with FUSE mount points

bash

# Configuration example: restrict FUSE usage on affected hosts

# 1. Check running kernel version
uname -r

# 2. Restrict fusermount to a trusted group
sudo chgrp fuse /usr/bin/fusermount3
sudo chmod 4750 /usr/bin/fusermount3

# 3. Disable user_allow_other in /etc/fuse.conf
sudo sed -i 's/^user_allow_other/#user_allow_other/' /etc/fuse.conf

# 4. Where FUSE is not required, unload the module
sudo modprobe -r fuse

# 5. Prevent auto-loading until the kernel is patched
echo 'blacklist fuse' | sudo tee /etc/modprobe.d/blacklist-fuse.conf